CVE-2026-7168

Wednesday, May 13, 2026

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Successfully using libcurl to do a transfer over a specific HTTP proxy (proxyA) with Digest authentication and then changing the proxy host to a second one (proxyB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to proxyB.

Affected Software

Vendor	Product	Version Range	Status
curl	curl	`8.19.0 <= 8.19.0`	affected
curl	curl	`8.18.0 <= 8.18.0`	affected
curl	curl	`8.17.0 <= 8.17.0`	affected
curl	curl	`8.16.0 <= 8.16.0`	affected
curl	curl	`8.15.0 <= 8.15.0`	affected
curl	curl	`8.14.1 <= 8.14.1`	affected
curl	curl	`8.14.0 <= 8.14.0`	affected
curl	curl	`8.13.0 <= 8.13.0`	affected
curl	curl	`8.12.1 <= 8.12.1`	affected
curl	curl	`8.12.0 <= 8.12.0`	affected
curl	curl	`8.11.1 <= 8.11.1`	affected
curl	curl	`8.11.0 <= 8.11.0`	affected
curl	curl	`8.10.1 <= 8.10.1`	affected
curl	curl	`8.10.0 <= 8.10.0`	affected
curl	curl	`8.9.1 <= 8.9.1`	affected
curl	curl	`8.9.0 <= 8.9.0`	affected
curl	curl	`8.8.0 <= 8.8.0`	affected
curl	curl	`8.7.1 <= 8.7.1`	affected
curl	curl	`8.7.0 <= 8.7.0`	affected
curl	curl	`8.6.0 <= 8.6.0`	affected
curl	curl	`8.5.0 <= 8.5.0`	affected
curl	curl	`8.4.0 <= 8.4.0`	affected
curl	curl	`8.3.0 <= 8.3.0`	affected
curl	curl	`8.2.1 <= 8.2.1`	affected
curl	curl	`8.2.0 <= 8.2.0`	affected
curl	curl	`8.1.2 <= 8.1.2`	affected
curl	curl	`8.1.1 <= 8.1.1`	affected
curl	curl	`8.1.0 <= 8.1.0`	affected
curl	curl	`8.0.1 <= 8.0.1`	affected
curl	curl	`8.0.0 <= 8.0.0`	affected
curl	curl	`7.88.1 <= 7.88.1`	affected
curl	curl	`7.88.0 <= 7.88.0`	affected
curl	curl	`7.87.0 <= 7.87.0`	affected
curl	curl	`7.86.0 <= 7.86.0`	affected
curl	curl	`7.85.0 <= 7.85.0`	affected
curl	curl	`7.84.0 <= 7.84.0`	affected
curl	curl	`7.83.1 <= 7.83.1`	affected
curl	curl	`7.83.0 <= 7.83.0`	affected
curl	curl	`7.82.0 <= 7.82.0`	affected
curl	curl	`7.81.0 <= 7.81.0`	affected
curl	curl	`7.80.0 <= 7.80.0`	affected
curl	curl	`7.79.1 <= 7.79.1`	affected
curl	curl	`7.79.0 <= 7.79.0`	affected
curl	curl	`7.78.0 <= 7.78.0`	affected
curl	curl	`7.77.0 <= 7.77.0`	affected
curl	curl	`7.76.1 <= 7.76.1`	affected
curl	curl	`7.76.0 <= 7.76.0`	affected
curl	curl	`7.75.0 <= 7.75.0`	affected
curl	curl	`7.74.0 <= 7.74.0`	affected
curl	curl	`7.73.0 <= 7.73.0`	affected
curl	curl	`7.72.0 <= 7.72.0`	affected
curl	curl	`7.71.1 <= 7.71.1`	affected
curl	curl	`7.71.0 <= 7.71.0`	affected
curl	curl	`7.70.0 <= 7.70.0`	affected
curl	curl	`7.69.1 <= 7.69.1`	affected
curl	curl	`7.69.0 <= 7.69.0`	affected
curl	curl	`7.68.0 <= 7.68.0`	affected
curl	curl	`7.67.0 <= 7.67.0`	affected
curl	curl	`7.66.0 <= 7.66.0`	affected
curl	curl	`7.65.3 <= 7.65.3`	affected
curl	curl	`7.65.2 <= 7.65.2`	affected
curl	curl	`7.65.1 <= 7.65.1`	affected
curl	curl	`7.65.0 <= 7.65.0`	affected
curl	curl	`7.64.1 <= 7.64.1`	affected
curl	curl	`7.64.0 <= 7.64.0`	affected
curl	curl	`7.63.0 <= 7.63.0`	affected
curl	curl	`7.62.0 <= 7.62.0`	affected
curl	curl	`7.61.1 <= 7.61.1`	affected
curl	curl	`7.61.0 <= 7.61.0`	affected
curl	curl	`7.60.0 <= 7.60.0`	affected
curl	curl	`7.59.0 <= 7.59.0`	affected
curl	curl	`7.58.0 <= 7.58.0`	affected
curl	curl	`7.57.0 <= 7.57.0`	affected
curl	curl	`7.56.1 <= 7.56.1`	affected
curl	curl	`7.56.0 <= 7.56.0`	affected
curl	curl	`7.55.1 <= 7.55.1`	affected
curl	curl	`7.55.0 <= 7.55.0`	affected
curl	curl	`7.54.1 <= 7.54.1`	affected
curl	curl	`7.54.0 <= 7.54.0`	affected
curl	curl	`7.53.1 <= 7.53.1`	affected
curl	curl	`7.53.0 <= 7.53.0`	affected
curl	curl	`7.52.1 <= 7.52.1`	affected
curl	curl	`7.52.0 <= 7.52.0`	affected
curl	curl	`7.51.0 <= 7.51.0`	affected
curl	curl	`7.50.3 <= 7.50.3`	affected
curl	curl	`7.50.2 <= 7.50.2`	affected
curl	curl	`7.50.1 <= 7.50.1`	affected
curl	curl	`7.50.0 <= 7.50.0`	affected
curl	curl	`7.49.1 <= 7.49.1`	affected
curl	curl	`7.49.0 <= 7.49.0`	affected
curl	curl	`7.48.0 <= 7.48.0`	affected
curl	curl	`7.47.1 <= 7.47.1`	affected
curl	curl	`7.47.0 <= 7.47.0`	affected
curl	curl	`7.46.0 <= 7.46.0`	affected
curl	curl	`7.45.0 <= 7.45.0`	affected
curl	curl	`7.44.0 <= 7.44.0`	affected
curl	curl	`7.43.0 <= 7.43.0`	affected
curl	curl	`7.42.1 <= 7.42.1`	affected
curl	curl	`7.42.0 <= 7.42.0`	affected
curl	curl	`7.41.0 <= 7.41.0`	affected
curl	curl	`7.40.0 <= 7.40.0`	affected
curl	curl	`7.39.0 <= 7.39.0`	affected
curl	curl	`7.38.0 <= 7.38.0`	affected
curl	curl	`7.37.1 <= 7.37.1`	affected
curl	curl	`7.37.0 <= 7.37.0`	affected
curl	curl	`7.36.0 <= 7.36.0`	affected
curl	curl	`7.35.0 <= 7.35.0`	affected
curl	curl	`7.34.0 <= 7.34.0`	affected
curl	curl	`7.33.0 <= 7.33.0`	affected
curl	curl	`7.32.0 <= 7.32.0`	affected
curl	curl	`7.31.0 <= 7.31.0`	affected
curl	curl	`7.30.0 <= 7.30.0`	affected
curl	curl	`7.29.0 <= 7.29.0`	affected
curl	curl	`7.28.1 <= 7.28.1`	affected
curl	curl	`7.28.0 <= 7.28.0`	affected
curl	curl	`7.27.0 <= 7.27.0`	affected
curl	curl	`7.26.0 <= 7.26.0`	affected
curl	curl	`7.25.0 <= 7.25.0`	affected
curl	curl	`7.24.0 <= 7.24.0`	affected
curl	curl	`7.23.1 <= 7.23.1`	affected
curl	curl	`7.23.0 <= 7.23.0`	affected
curl	curl	`7.22.0 <= 7.22.0`	affected
curl	curl	`7.21.7 <= 7.21.7`	affected
curl	curl	`7.21.6 <= 7.21.6`	affected
curl	curl	`7.21.5 <= 7.21.5`	affected
curl	curl	`7.21.4 <= 7.21.4`	affected
curl	curl	`7.21.3 <= 7.21.3`	affected
curl	curl	`7.21.2 <= 7.21.2`	affected
curl	curl	`7.21.1 <= 7.21.1`	affected
curl	curl	`7.21.0 <= 7.21.0`	affected
curl	curl	`7.20.1 <= 7.20.1`	affected
curl	curl	`7.20.0 <= 7.20.0`	affected
curl	curl	`7.19.7 <= 7.19.7`	affected
curl	curl	`7.19.6 <= 7.19.6`	affected
curl	curl	`7.19.5 <= 7.19.5`	affected
curl	curl	`7.19.4 <= 7.19.4`	affected
curl	curl	`7.19.3 <= 7.19.3`	affected
curl	curl	`7.19.2 <= 7.19.2`	affected
curl	curl	`7.19.1 <= 7.19.1`	affected
curl	curl	`7.19.0 <= 7.19.0`	affected
curl	curl	`7.18.2 <= 7.18.2`	affected
curl	curl	`7.18.1 <= 7.18.1`	affected
curl	curl	`7.18.0 <= 7.18.0`	affected
curl	curl	`7.17.1 <= 7.17.1`	affected
curl	curl	`7.17.0 <= 7.17.0`	affected
curl	curl	`7.16.4 <= 7.16.4`	affected
curl	curl	`7.16.3 <= 7.16.3`	affected
curl	curl	`7.16.2 <= 7.16.2`	affected
curl	curl	`7.16.1 <= 7.16.1`	affected
curl	curl	`7.16.0 <= 7.16.0`	affected
curl	curl	`7.15.5 <= 7.15.5`	affected
curl	curl	`7.15.4 <= 7.15.4`	affected
curl	curl	`7.15.3 <= 7.15.3`	affected
curl	curl	`7.15.2 <= 7.15.2`	affected
curl	curl	`7.15.1 <= 7.15.1`	affected
curl	curl	`7.15.0 <= 7.15.0`	affected
curl	curl	`7.14.1 <= 7.14.1`	affected
curl	curl	`7.14.0 <= 7.14.0`	affected
curl	curl	`7.13.2 <= 7.13.2`	affected
curl	curl	`7.13.1 <= 7.13.1`	affected
curl	curl	`7.13.0 <= 7.13.0`	affected
curl	curl	`7.12.3 <= 7.12.3`	affected
curl	curl	`7.12.2 <= 7.12.2`	affected
curl	curl	`7.12.1 <= 7.12.1`	affected
curl	curl	`7.12.0 <= 7.12.0`	affected

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

ADP Enrichment

CVE Program Container

Additional References

http://www.openwall.com/lists/oss-security/2026/04/29/14

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: yes
- Technical Impact: partial

Additional References

https://hackerone.com/reports/3697719

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.